Recent Cloud Atlas activity
securelist.com · Undated · Licence: not assessed; coordinator-only cache; do not redistribute
CVEs this report names
2 CVEs- CVE-2017-11882Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reports99.9%Top 0.03%88.5priority
- CVE-2018-0802Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution8 reports93.3%Top 0.17%88.4priority
Where it names them
CVE-2017-11882 Original (opens in a new tab) ↗
Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.
CVE-2018-0802 Original (opens in a new tab) ↗
Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.